8.8
CVE-2025-6755
- EPSS 0.72%
- Veröffentlicht 28.06.2025 05:29:51
- Zuletzt bearbeitet 07.07.2025 14:37:41
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginGame Users Share Buttons <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter
Game Users Share Buttons <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter
The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxDeleteTheme() function in all versions up to, and including, 1.3.0. This makes it possible for Subscriber-level attackers to add arbitrary file paths (such as ../../../../wp-config.php) to the themeNameId parameter of the AJAX request, which can lead to remote code execution.
Mögliche Gegenmaßnahme
Game Users Share Buttons: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gameusers ≫ Game Users Share Button SwPlatformwordpress Version <= 1.3.0
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
Game Users Share Buttons
Version
*-1.3.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.72% | 0.491 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security@wordfence.com | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
https://www.wordfence.com/threat-intel/vulnerabilities/id/f861ece5-21e4-4c7f-8701-bd9492b1b8bf?source=cve
https://wordpress.org/plugins/game-users-share-buttons/#developers
https://plugins.trac.wordpress.org/browser/game-users-share-buttons/tags/1.3.0/game-users-share-buttons.php#L638
https://www.wordfence.com/threat-intel/vulnerabilities/id/f861ece5-21e4-4c7f-8701-bd9492b1b8bf